T1565.001 Stored Data Manipulation Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

let CriticalFileExtensions = dynamic([".sql", ".db", ".sqlite", ".mdb", ".accdb", ".dbf", ".csv", ".xlsx", ".xls", ".docx", ".xml", ".json", ".config", ".conf", ".ini", ".cs", ".py", ".js"]);
let BackupExtensions = dynamic([".bk", ".bak", ".orig", ".backup", ".old", ".tmp"]);
let TrustedDBProcesses = dynamic(["sqlservr.exe", "mysqld.exe", "postgres.exe", "mongod.exe", "oracle.exe", "sqlite3.exe", "MsMpEng.exe", "OneDrive.exe", "OUTLOOK.EXE", "EXCEL.EXE", "WINWORD.EXE"]);
// Detect bulk modification of critical data files OR SUNSPOT-style backup-and-replace pattern
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName has_any (CriticalFileExtensions) or FileName has_any (BackupExtensions)
| where not(InitiatingProcessFileName has_any (TrustedDBProcesses))
| extend IsCriticalFile = FileName has_any (CriticalFileExtensions)
| extend IsBackupFile = FileName has_any (BackupExtensions)
| summarize
    TotalUniqueFiles = dcount(FileName),
    CriticalFileCount = countif(IsCriticalFile),
    BackupFileCount = countif(IsBackupFile),
    ModifiedFiles = make_set(FileName, 30),
    UniqueFolders = dcount(FolderPath),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName,
       InitiatingProcessCommandLine, InitiatingProcessId, bin(Timestamp, 5m)
| where TotalUniqueFiles >= 5
    or (BackupFileCount >= 1 and CriticalFileCount >= 1)
| extend DetectionReason = case(
    BackupFileCount >= 1 and CriticalFileCount >= 1, "BackupReplacePattern_SUNSPOT_Analog",
    TotalUniqueFiles >= 20, "BulkModification_High",
    TotalUniqueFiles >= 10, "BulkModification_Medium",
    "BulkModification_Low"
)
| extend RiskScore = case(
    DetectionReason == "BackupReplacePattern_SUNSPOT_Analog", 90,
    DetectionReason == "BulkModification_High", 80,
    DetectionReason == "BulkModification_Medium", 60,
    40
)
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessAccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         TotalUniqueFiles, CriticalFileCount, BackupFileCount,
         UniqueFolders, ModifiedFiles, DetectionReason, RiskScore
| sort by RiskScore desc, TotalUniqueFiles desc

high severity medium confidence

Data Sources

File: File Modification File: File Creation Microsoft Defender for Endpoint

Required Tables

DeviceFileEvents

False Positives

Software deployment or configuration management tools (Ansible, Chef, Puppet, SCCM) that atomically replace configuration files by writing to a temp file and renaming — creates backup-like patterns with high file counts
Backup agents (Veeam, Veritas, Acronis, Windows Server Backup) that create .bak copies of databases or config files before snapshotting — triggers both the backup-replace and bulk modification patterns
Development CI/CD pipelines (GitHub Actions, Jenkins, GitLab CI) that generate, compile, and write multiple source code or config files in rapid succession during build steps
Antivirus or DLP quarantine operations that move or rename files with modified extensions during remediation workflows
Database maintenance scripts (index rebuilds, VACUUM, CHECKPOINT operations run by scripts) that write temporary files alongside primary database files
Document management systems (SharePoint sync, Dropbox, OneDrive) that batch-sync large numbers of Office documents during initial sync or conflict resolution

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval TargetLower=lower(TargetFilename)
| eval IsCritical=if(match(TargetLower, "\.(sql|db|sqlite|mdb|accdb|dbf|csv|xlsx|xls|docx|xml|json|config|conf|ini|cs|py|js)$"), 1, 0)
| eval IsBackup=if(match(TargetLower, "\.(bk|bak|orig|backup|old|tmp)$"), 1, 0)
| eval TrustedProcess=if(match(lower(Image), "(sqlservr|mysqld|postgres|mongod|oracle|sqlite3|msmpeng|onedrive|outlook|excel|winword)\.exe$"), 1, 0)
| where (IsCritical=1 OR IsBackup=1) AND TrustedProcess=0
| bin _time span=5m
| stats
    count as TotalEvents,
    dc(TargetFilename) as UniqueFiles,
    sum(IsCritical) as CriticalFileCount,
    sum(IsBackup) as BackupFileCount,
    values(TargetFilename) as ModifiedFiles,
    dc(TargetFilename) as FolderCount
    by _time, host, Image, User, CommandLine, ProcessId
| where UniqueFiles >= 5 OR (BackupFileCount >= 1 AND CriticalFileCount >= 1)
| eval DetectionReason=case(
    BackupFileCount >= 1 AND CriticalFileCount >= 1, "BackupReplacePattern_SUNSPOT_Analog",
    UniqueFiles >= 20, "BulkModification_High",
    UniqueFiles >= 10, "BulkModification_Medium",
    true(), "BulkModification_Low"
)
| eval RiskScore=case(
    DetectionReason="BackupReplacePattern_SUNSPOT_Analog", 90,
    DetectionReason="BulkModification_High", 80,
    DetectionReason="BulkModification_Medium", 60,
    true(), 40
)
| table _time, host, User, Image, CommandLine, ProcessId, UniqueFiles, CriticalFileCount, BackupFileCount, ModifiedFiles, DetectionReason, RiskScore
| sort - RiskScore UniqueFiles

high severity medium confidence

Data Sources

File: File Modification File: File Creation Sysmon Event ID 11

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Software deployment or configuration management tools (Ansible, Chef, Puppet, SCCM) that atomically replace configuration files by writing temp files and renaming them
Backup agents (Veeam, Veritas, Acronis) that create .bak copies of databases or config files before snapshotting
CI/CD pipelines (GitHub Actions, Jenkins, GitLab CI) generating multiple source code or config files during build steps
Document management systems (SharePoint sync, Dropbox, OneDrive) performing batch-sync of Office documents
Database maintenance scripts writing temporary files alongside primary database files during index rebuilds or vacuum operations
Security tools or AV quarantine operations that rename files with modified extensions during remediation

Elastic Security (EQL)

eql

any where
  (event.category == "file" and event.type == "change" and
   file.extension : ("sql","db","sqlite","mdb","csv","xlsx","xls","docx","xml","json","config","conf") and
   not process.name : ("sqlservr.exe","mysqld","postgres","oracle","mongod","sqlite3",
                        "EXCEL.EXE","WINWORD.EXE","Code.exe","notepad.exe","vim","nano") and
   process.name : ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe",
                    "python*","perl","ruby","bash","sh","certutil.exe","bitsadmin.exe")) or
  (event.category == "process" and event.type == "start" and
   process.name : ("sqlcmd.exe","osql.exe","mysql.exe","psql.exe","sqlite3.exe") and
   process.args : ("*UPDATE*","*DELETE*","*DROP*","*INSERT*","*TRUNCATE*") and
   not process.parent.name : ("sqlservr.exe","mysqld","postgres","DBArtisan*"))

high severity medium confidence

Data Sources

Endpoint File Events Endpoint Process Events

Required Tables

logs-endpoint.events.file-* logs-endpoint.events.process-*

False Positives

Software deployment or configuration management tools (Ansible, Chef, Puppet, SCCM) that atomically replace configuration files by writing to a temp file and renaming — creates backup-like patterns with high file counts
Backup agents (Veeam, Veritas, Acronis, Windows Server Backup) that create .bak copies of databases or config files before snapshotting — triggers both the backup-replace and bulk modification patterns
Development CI/CD pipelines (GitHub Actions, Jenkins, GitLab CI) that generate, compile, and write multiple source code or config files in rapid succession during build steps
Antivirus or DLP quarantine operations that move or rename files with modified extensions during remediation workflows
Database maintenance scripts (index rebuilds, VACUUM, CHECKPOINT operations run by scripts) that write temporary files alongside primary database files
Document management systems (SharePoint sync, Dropbox, OneDrive) that batch-sync large numbers of Office documents during initial sync or conflict resolution

IBM QRadar (AQL)

sql

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime,
  logsourcename(logsourceid) as LogSource, username as User,
  "TargetFilename" as TargetFile, "Image" as ProcessImage, "CommandLine" as CommandLine,
  CASE WHEN "Image" ILIKE '%cmd.exe%' AND "TargetFilename" ILIKE '%.sql%' THEN 9
       WHEN "Image" ILIKE '%powershell%' AND "TargetFilename" ILIKE '%.db%' THEN 8
       WHEN "Image" ILIKE '%sqlcmd%' AND "CommandLine" ILIKE '%(UPDATE|DELETE|DROP)%' THEN 9
       ELSE 5 END as RiskScore
FROM events
WHERE eventid IN (1, 11, 23)
  AND (
    (eventid IN (11,23) AND
     ("TargetFilename" ILIKE '%.sql%' OR "TargetFilename" ILIKE '%.db%'
      OR "TargetFilename" ILIKE '%.sqlite%' OR "TargetFilename" ILIKE '%.csv%') AND
     LOWER("Image") LIKE ANY ('%cmd.exe%','%powershell%','%wscript%','%python%','%perl%','%certutil%'))
    OR (eventid = 1 AND LOWER("Image") LIKE ANY ('%sqlcmd%','%osql%','%mysql.exe%','%psql%') AND
        ("CommandLine" ILIKE '%UPDATE%' OR "CommandLine" ILIKE '%DELETE%'
         OR "CommandLine" ILIKE '%DROP%' OR "CommandLine" ILIKE '%TRUNCATE%'))
  )
ORDER BY RiskScore DESC, EventTime DESC

high severity medium confidence

Data Sources

Windows Sysmon

Required Tables

events

False Positives

Software deployment or configuration management tools (Ansible, Chef, Puppet, SCCM) that atomically replace configuration files by writing to a temp file and renaming — creates backup-like patterns with high file counts
Backup agents (Veeam, Veritas, Acronis, Windows Server Backup) that create .bak copies of databases or config files before snapshotting — triggers both the backup-replace and bulk modification patterns
Development CI/CD pipelines (GitHub Actions, Jenkins, GitLab CI) that generate, compile, and write multiple source code or config files in rapid succession during build steps
Antivirus or DLP quarantine operations that move or rename files with modified extensions during remediation workflows
Database maintenance scripts (index rebuilds, VACUUM, CHECKPOINT operations run by scripts) that write temporary files alongside primary database files
Document management systems (SharePoint sync, Dropbox, OneDrive) that batch-sync large numbers of Office documents during initial sync or conflict resolution

Sumo Logic CSE

sql

_sourceCategory=windows/sysmon OR _sourceCategory=linux/sysmon
| json auto
| where EventID in ("1","11","23")
| eval ImageLower = toLower(coalesce(Image,""))
| eval TargetLower = toLower(coalesce(TargetFilename,""))
| eval CmdLower = toLower(coalesce(CommandLine,""))
| eval is_file_mod = if(EventID in ("11","23") AND
    TargetLower matches ".*(\.(sql|db|sqlite|mdb|csv|xlsx|xls|docx|xml|json|config|conf))$" AND
    ImageLower matches ".*(cmd|powershell|pwsh|wscript|cscript|python|perl|ruby|certutil|bitsadmin).*", 1, 0)
| eval is_sql_exec = if(EventID == "1" AND
    ImageLower matches ".*(sqlcmd|osql|mysql|psql|sqlite3)\..*$" AND
    CmdLower matches ".*(update|delete|drop|truncate|insert).*", 1, 0)
| where is_file_mod == 1 OR is_sql_exec == 1
| table _time, Computer, User, Image, CommandLine, TargetFilename, ParentImage
| sort by _time desc

high severity medium confidence

Data Sources

Windows/Linux Sysmon via Sumo Logic

Required Tables

windows/sysmon linux/sysmon

False Positives

Software deployment or configuration management tools (Ansible, Chef, Puppet, SCCM) that atomically replace configuration files by writing to a temp file and renaming — creates backup-like patterns with high file counts
Backup agents (Veeam, Veritas, Acronis, Windows Server Backup) that create .bak copies of databases or config files before snapshotting — triggers both the backup-replace and bulk modification patterns
Development CI/CD pipelines (GitHub Actions, Jenkins, GitLab CI) that generate, compile, and write multiple source code or config files in rapid succession during build steps
Antivirus or DLP quarantine operations that move or rename files with modified extensions during remediation workflows
Database maintenance scripts (index rebuilds, VACUUM, CHECKPOINT operations run by scripts) that write temporary files alongside primary database files
Document management systems (SharePoint sync, Dropbox, OneDrive) that batch-sync large numbers of Office documents during initial sync or conflict resolution

Google Chronicle / SecOps

yaral

rule stored_data_manipulation {
  meta:
    author = "Detection Engineering"
    description = "Detects unauthorized stored data manipulation (T1565.001)"
    severity = "HIGH"
    tactic = "TA0040"

  events:
    $e.metadata.event_type = "FILE_MODIFICATION"
    re.regex($e.target.file.full_path, `(?i)\.(sql|db|sqlite|mdb|csv|xlsx|json|config|conf)$`) nocase
    re.regex($e.principal.process.file.full_path, `(?i)(cmd\.exe|powershell|wscript|cscript|python|perl|certutil|bitsadmin)`) nocase

  condition:
    $e
}

high severity medium confidence

Data Sources

Endpoint File Events via Chronicle UDM

Required Tables

FILE_MODIFICATION

False Positives

Software deployment or configuration management tools (Ansible, Chef, Puppet, SCCM) that atomically replace configuration files by writing to a temp file and renaming — creates backup-like patterns with high file counts
Backup agents (Veeam, Veritas, Acronis, Windows Server Backup) that create .bak copies of databases or config files before snapshotting — triggers both the backup-replace and bulk modification patterns
Development CI/CD pipelines (GitHub Actions, Jenkins, GitLab CI) that generate, compile, and write multiple source code or config files in rapid succession during build steps
Antivirus or DLP quarantine operations that move or rename files with modified extensions during remediation workflows
Database maintenance scripts (index rebuilds, VACUUM, CHECKPOINT operations run by scripts) that write temporary files alongside primary database files
Document management systems (SharePoint sync, Dropbox, OneDrive) that batch-sync large numbers of Office documents during initial sync or conflict resolution

CrowdStrike LogScale (CQL)

cql

#event_simpleName = "ProcessRollup2"
| (ImageFileName = /(cmd|powershell|pwsh|wscript|cscript|python|perl|ruby|certutil)\.exe$/i
   AND TargetFileName = /\.(sql|db|sqlite|mdb|csv|xlsx|json|config|conf)$/i)
  OR (ImageFileName = /(sqlcmd|osql|mysql|psql|sqlite3)\.exe$/i
      AND CommandLine = /(UPDATE|DELETE|DROP|TRUNCATE|INSERT)/i)
| eval detection_type = case {
    ImageFileName = /(sqlcmd|osql|mysql|psql|sqlite3)\.exe$/i : "SQL_DML_Execution";
    * : "Data_File_Modified"
  }
| table timestamp, ComputerName, UserName, ImageFileName, CommandLine, TargetFileName, detection_type
| sort by timestamp desc

high severity medium confidence

Data Sources

CrowdStrike Falcon Process Events

Required Tables

ProcessRollup2

False Positives

Software deployment or configuration management tools (Ansible, Chef, Puppet, SCCM) that atomically replace configuration files by writing to a temp file and renaming — creates backup-like patterns with high file counts
Backup agents (Veeam, Veritas, Acronis, Windows Server Backup) that create .bak copies of databases or config files before snapshotting — triggers both the backup-replace and bulk modification patterns
Development CI/CD pipelines (GitHub Actions, Jenkins, GitLab CI) that generate, compile, and write multiple source code or config files in rapid succession during build steps
Antivirus or DLP quarantine operations that move or rename files with modified extensions during remediation workflows
Database maintenance scripts (index rebuilds, VACUUM, CHECKPOINT operations run by scripts) that write temporary files alongside primary database files
Document management systems (SharePoint sync, Dropbox, OneDrive) that batch-sync large numbers of Office documents during initial sync or conflict resolution

Stored Data Manipulation

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Impact

Popular Detections